Data processing addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service (the "Agreement") between the customer identified in the Agreement ("Customer") and Open Curiosity, Inc., a United States company ("Open Curiosity," "we," or "us"). By using OpenTag under the Agreement, Customer agrees to this DPA. Capitalized terms not defined here have the meaning in the Agreement or, where used in the sense of the GDPR, the meaning given there.

1. Roles

Customer Content means the instructions Customer gives OpenTag, files Customer uploads, connected-account content OpenTag accesses at Customer's direction, and outputs OpenTag produces for Customer. For that content, Customer is the controller (or a processor acting for its own customer) and Open Curiosity is the processor.

For Account Data (names, emails, and profile details used to operate Customer's account) and Service Usage Data (operational logs, metering, and content-masked analytics), Open Curiosity acts as an independent controller, as described in our Privacy Policy. Those categories are outside the processor obligations in Sections 2–8, except where Data Protection Laws require otherwise.

2. Customer instructions

Open Curiosity will process Customer Personal Data only (a) to provide OpenTag under the Agreement, (b) as documented in this DPA and the Privacy Policy, and (c) on other documented instructions from Customer, unless law requires otherwise, in which case we will inform Customer before processing unless the law prohibits it. Customer is responsible for the lawfulness of its instructions and of the Personal Data it provides or directs OpenTag to access.

Open Curiosity will not sell Customer Personal Data, use it to train generalized AI or machine-learning models (ours or anyone else's), or use it for advertising. Model providers we engage are contractually prohibited from training on the data we send them.

3. Details of processing

• Subject matter: providing OpenTag as a personal agent that performs tasks Customer delegates across connected apps and accounts.
• Duration: for the term of the Agreement and until deletion or return under Section 7.
• Nature and purpose: hosting, storing, transmitting, and using Customer Personal Data to run Customer's OpenTag environment, call tools Customer enables, generate model responses, and operate related support and security functions.
• Types of Personal Data: account identifiers; communications and instructions; connected-app content Customer directs OpenTag to access (which may include names, emails, messages, files, and similar business data, and may incidentally include special-category data in content Customer directs OpenTag to process); credentials and tokens Customer provides; and task, memory, and run records needed to operate the Service.
• Categories of data subjects: Customer's users and, where Customer Content includes it, third parties whose information appears in connected accounts or materials Customer directs OpenTag to process.

4. Sub-processors

Customer authorizes Open Curiosity to engage the sub-processors listed in our Trust Center to process Customer Personal Data as needed to provide the Service. We will enter into written terms with each sub-processor that impose data-protection obligations no less protective than those in this DPA for the services they perform, and we remain responsible for each sub-processor's performance of those obligations.

We will update that list when we add or replace a sub-processor. Where Customer's Agreement requires advance notice of a new sub-processor, we will give that notice as the Agreement provides. Customer may object on reasonable data-protection grounds; if we cannot provide a commercially reasonable alternative, Customer may discontinue the affected Service as the Agreement allows.

Apps and accounts Customer connects itself are not Open Curiosity sub-processors. Customer's use of each is governed by Customer's own agreement with that provider.

5. Security

Taking into account the state of the art, implementation costs, and the nature, scope, context, and purposes of processing, Open Curiosity maintains appropriate technical and organizational measures to protect Customer Personal Data, including:

• Encryption in transit (TLS 1.3) and at rest (AES-256), with integration credentials held in a separate vault under per-tenant keys.
• Isolation of each workspace so Customer Content, memory, files, and learned formats do not cross between customers.
• Access controls, audit logging of OpenTag's runs, and approval gates for irreversible actions.
• Personnel access limited to what is needed to operate, secure, and support the Service, under confidentiality obligations.
• Processes to detect, investigate, and respond to Personal Data Breaches, and to notify Customer without undue delay after we become aware of a breach affecting Customer Personal Data, with the information reasonably needed for Customer's own notification obligations.

More detail on the product trust model is on our Security page, and current compliance status is published in our Trust Center. SOC 2 Type I is completed. SOC 2 Type II is in progress.

6. International transfers

Open Curiosity is based in the United States, and OpenTag environments are operated on infrastructure in the United States. Where Customer Personal Data is transferred from the EEA, UK, or Switzerland to a country that does not benefit from an adequacy decision, the parties rely on appropriate safeguards under applicable Data Protection Laws, including the European Commission's Standard Contractual Clauses (Module Two for controller to processor, or Module Three for processor to processor, as applicable) and, for the UK, the International Data Transfer Addendum, which are incorporated by reference and completed with the details in Section 3 and our Security and sub-processor disclosures. For Swiss transfers, the Clauses apply as adapted under the Swiss Federal Act on Data Protection, with the Federal Data Protection and Information Commissioner as the competent authority. The Clauses control any conflict with this DPA.

7. Assistance, deletion, and audits

Taking into account the nature of processing, Open Curiosity will assist Customer with reasonable requests related to data-subject rights, DPIAs, and consultations with supervisory authorities, to the extent Customer cannot do so unaided through the Service. If a data subject contacts us about Customer Personal Data, we will promptly notify Customer and redirect the requester unless law requires us to respond.

On termination or a verified deletion request, we will, at Customer's choice, return Customer Personal Data in a commonly used, machine-readable format and delete it, or delete it without return, within 30 days. Data retained by law will remain isolated and protected. We will confirm deletion in writing on request.

Upon written request no more than once per twelve months (unless a supervisory authority or documented Personal Data Breach requires more), Open Curiosity will make available information reasonably necessary to demonstrate compliance with this DPA. If that is not sufficient, Customer or an auditor Customer appoints may audit and inspect the facilities and systems relevant to Customer Personal Data, on reasonable notice and under confidentiality, without disrupting operations or exposing other customers' data. We will assist.

8. CCPA / CPRA service provider

To the extent the California Consumer Privacy Act (as amended) applies to Customer Personal Data processed under this DPA, Open Curiosity is a "service provider." We will not sell or share that personal information, retain, use, or disclose it outside the business purpose of providing the Service (or as otherwise permitted by that law), or combine it with personal information from other sources except as the Service and that law allow. We certify that we understand these restrictions. Where another U.S. state privacy law applies to Customer Personal Data, we will meet its applicable processor requirements.

9. Conflict and contact

If this DPA conflicts with the Agreement on the same subject, this DPA controls for that subject. Questions: privacy@tryopentag.com.